API documentation

The complete REST reference for BrokPass — one hosted API to verify insurance intermediaries in ORIAS, FSMA, AFM, CBI, returning one normalized JSON record. No API key needed on the free demo tier.

Base URL: https://brokpass.com · Documentation en français : /api-documentation

Quick start

Verify an intermediary in any covered register with a single GET request — one curl per country:

# Discovery — supported countries and capabilities
curl "https://brokpass.com/api/verify"

# 🇫🇷 France — ORIAS (SIREN / N° ORIAS)
curl "https://brokpass.com/api/verify?country=FR&id=542073580"
# 🇧🇪 Belgium — FSMA (BCE/KBO)
curl "https://brokpass.com/api/verify?country=BE&id=0202239951"
# 🇳🇱 Netherlands — AFM (KvK)
curl "https://brokpass.com/api/verify?country=NL&id=54942454"
# 🇮🇪 Ireland — CBI (C-number)
curl "https://brokpass.com/api/verify?country=IE&id=C10015"

Successful responses are CDN-cached (Cache-Control: s-maxage=86400, stale-while-revalidate on /api/verify, s-maxage=3600 on auto-detect). Free-tier rate limits apply — see rate limits.

GET/api/verify?country=<ISO2>&id=<id>

Verify in a specific register

Country-scoped verification. Returns the normalized Intermediary record — identical across FR, BE, NL and IE.

Parameter	Type	Required	Description
`country`	string	Yes	ISO 3166 alpha-2 code (FR, BE, NL, IE). Case-insensitive.
`id`	string	Yes	Country-specific identifier (SIREN / N° ORIAS, BCE/KBO, KvK, C-number).

If only one of the two parameters is provided, the API answers 400 with { "error": "Provide both `country` (ISO alpha-2) and `id`." } (no code field). With no parameters, it returns the country list (see discovery).

The normalized `Intermediary` record

Every register speaks its own dialect; the connectors translate all of them into this single shape, so an integration written for one country works for every country we add.

Field	Type	Description
`country`	string	ISO 3166 alpha-2 country code (e.g. “FR”).
`register`	string	Official register name (ORIAS, FSMA, AFM, CBI).
`nationalId`	string \| null	Registration number in that register (ORIAS number, BCE/KBO number, CBI reference…).
`companyId`	string \| null	Company id (SIREN, BCE/KBO, KvK…). Can be null.
`name`	string \| null	Legal / trading name of the intermediary.
`status`	enum	Normalized status — see the Status values below.
`categories`	Category[]	Registration categories, normalized (see the Category object).
`address`	string \| null	One-line address, where the register publishes it (synced registers).
`validFrom`	string \| null	Registration start date, ISO format (YYYY-MM-DD).
`passportCountries`	string[]	ISO alpha-2 EEA countries the entity may operate in (freedom of services / establishment).
`sourceUrl`	string \| null	URL of the official register source for this record.
`fetchedAt`	string	ISO 8601 timestamp the data was obtained.

The `Category` object

Field	Type	Description
`code`	string	Raw national category code (e.g. “COA”, “BROKER”, “INSURANCE_INTERMEDIARY”).
`label`	string	Human-readable category label as published by the register.
`group`	enum	Normalized bucket — see the CategoryGroup values below.
`status`	enum (optional)	Per-category status where the register provides it (ORIAS).

`status` values

registeredstruck_offsuspendednot_foundunknown

`category.group` values

insurance_brokerinsurance_agentinsurance_sub_agentreinsurancebanking_creditinvestmentancillaryother

GET /api/verify?country=FR&id=542073580 (live register)

{
  "country": "FR",
  "register": "ORIAS",
  "nationalId": "07022455",
  "companyId": "542073580",
  "name": "MAAF ASSURANCES SA",
  "status": "registered",
  "categories": [
    { "code": "COA", "label": "COA", "group": "insurance_broker", "status": "registered" }
  ],
  "address": null,
  "validFrom": null,
  "passportCountries": [],
  "sourceUrl": "https://www.orias.fr/home/showIntermediaire/542073580",
  "fetchedAt": "2026-07-24T09:12:45.000Z"
}

GET /api/verify?country=BE&id=0202239951 (synced register)

{
  "country": "BE",
  "register": "FSMA",
  "nationalId": "0202239951",
  "companyId": "0202239951",
  "name": "PROXIMUS SA",
  "status": "registered",
  "categories": [
    { "code": "ANCILLARY", "label": "Nevenverzekeringstussenpersoon", "group": "ancillary" }
  ],
  "address": "Koning Albert II-laan 27, 1030 Schaarbeek, BE",
  "validFrom": "2019-04-01",
  "passportCountries": [],
  "sourceUrl": "https://www.fsma.be/sites/default/files/media/files/replacement_files/itp_mdm_intermediaries_in_insurance_NL.xlsx",
  "fetchedAt": "2026-07-24T03:04:11.000Z"
}

Illustrative values — the structure is what matters. Synced (ETL) registers also fill address and validFrom; the live ORIAS connector does not. FSMA categories carry no per-category status.

GET/api/verify/auto?id=<id>[&prefer=<ISO2>]

Smart auto-detect

Resolves the country from the identifier format alone (the same per-country patterns that drive the web tool), queries every candidate register in parallel, and returns the first real match with an extra detectedCountry field. If the format matches no covered register, the response is 404 not_found without any register being queried.

Disambiguation — when several registers recognise the same identifier, you get HTTP 200 with a candidates array instead of a record. Re-query the chosen country via /api/verify.
prefer (optional) — biases resolution: when the id format matches several countries and the preferred one is among them, that register is tried first and a real hit is returned immediately, skipping disambiguation. A preferred-register miss falls back to the normal parallel flow over the remaining candidates.

# Auto-detect — resolve the country from the id format alone
curl "https://brokpass.com/api/verify/auto?id=C10015"

# Bias resolution towards one register when formats collide
curl "https://brokpass.com/api/verify/auto?id=542073580&prefer=FR"

200 — several registers matched: disambiguation payload

{
  "candidates": [
    { "country": "FR", "register": "ORIAS", "name": "EXAMPLE COURTAGE",  "status": "registered" },
    { "country": "NL", "register": "AFM",   "name": "EXAMPLE ADVIES BV", "status": "registered" }
  ]
}

GET/api/verify

Discovery

Called with no parameters, /api/verify lists the supported countries and their capabilities (kind = live or etl). Enumerate coverage at runtime instead of hardcoding countries.

GET https://brokpass.com/api/verify

{
  "countries": [
    { "country": "FR", "register": "ORIAS", "kind": "live", "realtime": true },
    { "country": "BE", "register": "FSMA", "kind": "etl",  "realtime": false },
    { "country": "NL", "register": "AFM",  "kind": "etl",  "realtime": false },
    { "country": "IE", "register": "CBI",  "kind": "etl",  "realtime": false }
  ]
}

Errors

On failure, the verify endpoints return a JSON body of the shape { "error": string, "code": string, "details"?: string } — details is only present in development environments.

Code	HTTP	Meaning
`unsupported_country`	400	The requested country has no register connector (e.g. country=DE).
`invalid_id`	400	Empty or malformed identifier for that register (BE / NL / IE).
`orias_error`	400	Invalid French format: the identifier must be a SIREN (9 digits) or an ORIAS number (8 digits).
`not_found`	404	No intermediary found for this identifier in the selected register(s).
`timeout`	504	The official register did not respond in time.
`internal_error`	500	Unexpected internal error during verification.

Rate limits

The free demo tier applies a hard ceiling of 20 requests per IP per day (fixed window, resets at 00:00 UTC), shared across all protected endpoints (/api/verify, /api/verify/auto, /api/orias/* and the MCP server), plus a site-wide daily cap. IPv6 clients are keyed by their /64 prefix. The limiter fails open: an infrastructure hiccup never blocks legitimate users. For production volumes and API keys, contact assurtech@yet.lu — see pricing.

Header	Description
`RateLimit-Limit`	Requests allowed per IP per UTC day. Value: 20.
`RateLimit-Remaining`	Requests remaining for this IP in today's window.
`RateLimit-Reset`	Seconds until the window resets at 00:00 UTC.
`Retry-After`	Seconds to wait before retrying (only set on a 429).

429 — free demo limit reached

HTTP/1.1 429 Too Many Requests
RateLimit-Limit: 20
RateLimit-Remaining: 0
RateLimit-Reset: 41551
Retry-After: 41551

{
  "error": "Ceci est un service de démonstration gratuit (limite : 20 requêtes/jour). Pour un usage en production, contactez notre équipe : ask@yet.lu · +352 621 436 580. — This is a free demo service (limit: 20 requests/day). For production use, contact our team: ask@yet.lu · +352 621 436 580.",
  "contact": "ask@yet.lu"
}

Legacy ORIAS endpoints (France only)

Two France-specific REST routes predate the multi-country surface and remain fully supported. They return the historical { company: { … } } shape (French status wording, raw ORIAS categories, collectFunds flag). For new integrations, prefer /api/verify?country=FR&id=….

GET/api/orias/siren/{siren}

Parameter: siren — 9-digit SIREN number

Invalid format: 400 { "error": "Invalid SIREN format. Must be 9 digits." }

GET/api/orias/registration/{orias}

Parameter: orias — 8-digit ORIAS number

Invalid format: 400 { "error": "Invalid ORIAS format. Must be 8 digits." }

# Legacy ORIAS (France only) — { company } response shape
curl "https://brokpass.com/api/orias/siren/542073580"
curl "https://brokpass.com/api/orias/registration/07022455"

200 — legacy { company } shape

{
  "company": {
    "name": "MAAF ASSURANCES SA",
    "status": "Inscrit",
    "orias_number": "07022455",
    "siren": "542073580",
    "categories": [
      {
        "categoryName": "COA",
        "status": "INSCRIT",
        "registrationDate": "2007-01-15",
        "collectFunds": "true"
      }
    ]
  }
}

Same rate limiting and CDN caching as /api/verify. On error these routes return { "error": string, "details"?: string } without a code field.

MCP server

BrokPass exposes a Model Context Protocol server compatible with Claude Desktop, Cursor, Cline and other MCP clients. It runs stateless (Streamable HTTP) and shares the same rate limiting on tool calls (POST requests).

POST https://brokpass.com/api/mcp

Available tools

verify_orias — verifies an ORIAS number (8 digits) or SIREN (9 digits). Returns verified, company details and a verification URL.
analyze_insurance_contract — informational: points to the web contract analyzer.
search_broker_by_location — informational: helps find a verified broker by city.

The MCP server currently covers France (ORIAS) only. For multi-country verification, use the REST endpoint /api/verify.

Client configuration

{
  "mcpServers": {
    "brokpass": {
      "url": "https://brokpass.com/api/mcp"
    }
  }
}

Attribution & data sources

Every record carries a sourceUrl pointing at the official register. When you display BrokPass results to end users, credit the source register — the synced datasets are official open data published under each register's licence and attribution terms:

🇫🇷 France: Source: ORIAS — orias.fr (queried live)
🇧🇪 Belgium: Source: FSMA — fsma.be (official open data, synced)
🇳🇱 Netherlands: Source: AFM — afm.nl (official open data, synced)
🇮🇪 Ireland: Source: CBI — centralbank.ie (official open data, synced)

BrokPass is an independent verification service — not operated, endorsed or approved by any supervisory authority. Raw register data may not be resold; BrokPass plans sell verification, normalization and monitoring as a service. For a legally authoritative confirmation, always consult the official register (linked on every result).

Ready to integrate?

Try the live tool, check the per-register guides (ORIAS · FSMA · AFM · CBI), or talk to us about production access and API keys.

assurtech@yet.lu See pricing